ASUS LPE Flaw (CVE-2025-59373): High-Severity Bug Grants SYSTEM Privileges via MyASUS Component

ASUS has issued critical security updates for a local privilege escalation (LPE) vulnerability tracked as CVE-2025-59373, with a CVSS score of 8.4 (High). This flaw affects the ASUS System Control Interface Service, allowing low-privileged users to escalate privileges to SYSTEM level by exploiting a flawed file-restore mechanism. The vulnerability impacts all ASUS personal computers, including desktops, laptops, NUC systems, and All-in-One PCs.

ASUS has released updates in versions 3.1.48.0 (x64) and 4.2.48.0 (ARM) to address this issue. Users can check their version in MyASUS settings and obtain updates via Windows Update or the ASUS Support site.